Skip to content
Snippets Groups Projects
Commit f8a4bf59 authored by Michael Tokarev's avatar Michael Tokarev Committed by Aurelien Jarno
Browse files

vnc: tight: Fix crash after 2GB of output


fix 2Gb integer overflow in in VNC tight and zlib encodings

As found by Roland Dreier <roland@purestorage.com> (excellent
catch!), when amount of VNC compressed data produced by zlib
and sent to client exceeds 2Gb, integer overflow occurs because
currently, we calculate amount of data produced at each step by
comparing saved total_out with new total_out, and total_out is
something which grows without bounds.  Compare it with previous
avail_out instead of total_out, and leave total_out alone.

The same code is used in vnc-enc-tight.c and vnc-enc-zlib.c,
so fix both cases.

There, there's no actual need to save previous_out value, since
capacity-offset (which is how that value is calculated) stays
the same so it can be recalculated again after call to deflate(),
but whole thing becomes less readable this way.

Reported-by: default avatarRoland Dreier <roland@purestorage.com>
Signed-off-by: default avatarMichael Tokarev <mjt@tls.msk.ru>
Signed-off-by: default avatarCorentin Chary <corentin.chary@gmail.com>
Signed-off-by: default avatarAurelien Jarno <aurelien@aurel32.net>
parent b3d657bc
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment